We Claim: 



1 LA method for monitoring and controlling communications on a computer 

2 network, the computer network having a distribution node, comprising the steps of: 

3 establishing a connection between a monitoring station and the computer network; 

4 automatically retrieving a likely target file from the distribution node; and 

5 automatically determining whether the likely target file contains illegal or undesirable 

6 content. 

1 2. The method of claim 1, further comprising the step of automatically saving 

2 identification information for the distribution node. 

1 3. The method of claim 2, wherein in the event that the automatically determining 

2 step establishes that the likely target file does contain illegal or undesirable content, the method 

3 further comprises the steps of: 

4 automatically choosing an enforcement order; and 

5 automatically executing the enforcement order against the distribution node. 

1 4. The method of claim 3, wherein the enforcement order is an order to limit the 

2 network access of the distribution node. 



{M:\9386\0m709\00046069.DOC llllllllllllin } 

11 



1 5. The method of claim 3, wherein the step of automatically choosing an 

2 enforcement order comprises the steps of: 

3 creating an electronic notice, the electronic notice comprising an identifier of the 

4 distribution node; and 

5 using an enforcement rule to derive an enforcement order from the electronic notice. 

1 6. The method of claim 1, wherein the automatically determining step further 

2 comprises the steps of: 

3 automatically deriving a fingerprint from the likely target file; 

4 automatically comparing the fingerprint with one or more previously stored fingerprints 

5 corresponding to one or more target files. 

1 7. The method of claim 1, wherein the automatically determining step further 

2 comprises the step of: 

3 automatically extracting a watermark from the likely target file. 
4 

1 8. The method of claim 1, wherein the automatically retrieving step, further 

2 includes the step of automatically identifying the likely target file. 

1 9. The method of claim 8, wherein the step of automatically identifying a likely 

2 target file is performed based on one or more criteria chosen form the group of file name, file 

3 size, a hash value derived from the file, existing description of file contents, and metadata 

4 associated with the file. 

1 10. A method for monitoring and controlling communications on a computer 

2 network, the computer network having a distribution node, comprising the steps of: 

3 establishing a connection between a monitoring station and the computer network; 

4 automatically retrieving a likely target file from the distribution node; 

5 automatically determining whether the likely target file contains illegal or undesirable 

6 content; 
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7 automatically saving identification information for the distribution node; 

8 automatically choosing an enforcement order; and 

9 automatically executing the enforcement order against the distribution node. 

1 1 1 . A system for monitoring and control of communications over a computer 

2 network, comprising: 

3 a plurality of network nodes; 

4 a traffic controller, connected to the plurality of network nodes, and a computer 

5 network, and controlling a plurality of connections between the network nodes and the 

6 computer network; 

7 a control station connected to the traffic controller; and 

8 a monitoring station connected to the control station and the computer network, 

9 wherein the monitoring station monitors whether illegal or undesirable content is being 



10 offered on the computer network, and in the event that such content is being offered sends 

1 1 electronic notices to the control station, the control station selects an enforcement order and the 

12 traffic controller executes the enforcement order by limiting access to the computer network 

13 from one or more of the plurality of network nodes. 

1 12. The system of claim 11, wherein the monitoring station comprises a stored list 

2 of identifiers of illegal or undesirable content. 

1 13. The system of claim 12, wherein the identifiers are fingerprints. 
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1 14. The system of claim 11, wherein the control station comprises a stored list of 

2 enforcement rules, and is configured to use the enforcement rules to derive enforcement orders 

3 from electronic notices. 

1 15. The system of claim 11, wherein a plurality of traffic controllers and a plurality 

2 of monitoring stations are connected to the control station, and the control station chooses a 

3 destination traffic controller and sends the enforcement order to the destination traffic 

4 controller. 

1 16. The system of claim 11, wherein a plurality of control stations are each 

2 connected to every one of the plurality of monitoring stations. 

1 17. A device for monitoring and controlling network communications among several 

2 nodes on a computer network one of the nodes being a distribution node, comprising: 

3 a processor; and 

4 a memory storing processing instructions for controlling the processor, the processor 

5 operative with the processing instructions to: 

6 establish a connection between the device and the computer network; 

7 automatically retrieve a likely target file from the distribution node; 

8 automatically determine whether the likely target file contains illegal or undesirable 

9 content; 

10 automatically save identification information for the distribution node; 

1 1 automatically choose an enforcement order; and 

12 automatically execute the enforcement order against the distribution node. 

1 18. The device of claim 17, wherein the memory further stores: 

2 a plurality of enforcement rules; and 

3 a plurality of enforcement orders. 
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1 19. A system for monitoring and controlling network communications among 

2 several nodes on a computer network one of the nodes being a distribution node, comprising a 

3 first device, the first device comprising: 

4 a first processor; and 

5 a first memory storing a first set of processing instructions for controlling first the 

6 processor, the first processor operative with the first set of processing instructions to: 

7 establish a connection between the first device and the computer network; 

8 automatically retrieve a likely target file from the distribution node; 

9 automatically determine whether the likely target file contains illegal or undesirable 

10 content; and 

1 1 automatically save identification information for the distribution node. 

1 20. The system of claim 19, further comprising a second device the second device 

2 comprising: 

3 a second processor; and 

4 a second memory storing a second set of processing instructions for controlling the 

5 second processor, the second processor operative with the second set of processing instructions 

6 to automatically choose an enforcement order. 

1 21. The system of claim 20, further comprising a second device the second device 

2 comprising: 

3 a third processor; and 

4 a third memory storing a third set of processing instructions for controlling the third 

5 processor, the third processor operative with the third set of processing instructions to 

6 automatically execute the enforcement order against the distribution node. 
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